DataEase CVE-2026-104141

Requires an authenticated DataEase account that has access to a configured datasource (PR:L); the attacker then supplies crafted identifiers - schema name, connection username, table name, or database name - into datasource metadata operations (getSchema, validate, save, update). These values are injected into metadata queries run via a plain JDBC Statement in CalciteProvider, so the SQL executes against the configured backend using DataEase's stored datasource credentials. No victim action or user interaction is needed. Exploitation is LIMITED by the need for valid credentials with datasource access and by the privileges of the application-held datasource account on the target database; it does not apply to anonymous/unauthenticated users. Fixed in v2.10.27.

This is a genuine CWE-89 SQL injection in DataEase's CalciteProvider, where user-supplied schema names, connection usernames, table names, and database names were concatenated into metadata queries executed via a plain JDBC Statement rather than parameterized/quoted. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates remote, low-complexity exploitation with no user interaction, and the high VC:H/VI:H/VA:H impact reflects full compromise of the connected backend database using the application-held datasource credentials. The key limiting signal is PR:L: this is NOT unauthenticated - the attacker must be an authenticated DataEase user who already has datasource access, which meaningfully narrows the threat to insiders or attackers who have obtained valid credentials. No CISA KEV listing and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis'; EPSS was not supplied. The signals are internally consistent (network vector, authenticated, high impact) with no contradictions, but the real-world priority is tempered by the authentication prerequisite and the fact that the attacker typically already holds some database reach through the datasource feature - the elevation is from configured-datasource access to arbitrary SQL against that backend with the app's credentials.

An authenticated DataEase user who has access to a configured datasource edits or validates a datasource, injecting crafted SQL metacharacters into the schema name, table name, database name, or connection username fields. When DataEase runs getSchema/validate/save/update, CalciteProvider concatenates the malicious identifier into a metadata query run as a plain JDBC Statement, executing attacker-controlled SQL against the backend with the application's stored datasource credentials. No public exploit code was identified at the time of analysis, and no victim interaction is required.